diff mbox

[FFmpeg-devel,3/3] avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()

Message ID 20180816133629.9352-3-michael@niedermayer.cc
State Accepted
Commit c2eec1762d372663c35aaf3d6ee419bafb185057
Headers show

Commit Message

Michael Niedermayer Aug. 16, 2018, 1:36 p.m. UTC 
Fixes: long running loop
Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/rmdec.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Paul B Mahol Aug. 16, 2018, 1:48 p.m. UTC | #1 
On 8/16/18, Michael Niedermayer <michael@niedermayer.cc> wrote:
> Fixes: long running loop
> Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6
>
> Found-by: Paul Ch <paulcher@icloud.com>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/rmdec.c | 2 ++
>  1 file changed, 2 insertions(+)

LGTM
Michael Niedermayer Aug. 17, 2018, 7:45 p.m. UTC | #2 
On Thu, Aug 16, 2018 at 03:48:24PM +0200, Paul B Mahol wrote:
> On 8/16/18, Michael Niedermayer <michael@niedermayer.cc> wrote:
> > Fixes: long running loop
> > Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6
> >
> > Found-by: Paul Ch <paulcher@icloud.com>
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavformat/rmdec.c | 2 ++
> >  1 file changed, 2 insertions(+)
> 
> LGTM

will apply

thanks

[...]
diff mbox

Patch

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 0216003e88..f26c5b4d90 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -1269,6 +1269,8 @@  static int ivr_read_header(AVFormatContext *s)
                 if (avio_rb32(pb) == MKBETAG('M', 'L', 'T', 'I')) {
                     ret = rm_read_multi(s, pb, st, NULL);
                 } else {
+                    if (avio_feof(pb))
+                        return AVERROR_INVALIDDATA;
                     avio_seek(pb, -4, SEEK_CUR);
                     ret = ff_rm_read_mdpr_codecdata(s, pb, st, st->priv_data, len, NULL);
                 }